Pentest Copilot
An open-source, browser-based AI agent that runs penetration testing tools autonomously against a connected Kali attack box, reading results and deciding its own next steps.
Pentest Copilot is an AI-driven penetration testing agent built for real engagements, boot2root boxes and CTFs. Given a target description, it runs commands on a connected Kali attack box, reads the output, and loops through further steps on its own, with up to 25 iterations per turn. It has 16 agent tools, including bash and Python execution, tool installation, Google search, subagent spawning, Burp Suite's proxy history, Repeater, Intruder and Collaborator, and browser automation for testing login flows and JavaScript-heavy apps.
It draws on a curated registry of security tools and packages across categories such as network, reversing, pwn, crypto, forensics and stego, installing only what a task needs, and supports VPN connections and parallel subagents for concurrent tasks. Dangerous commands require explicit approval even in auto-run mode, and it can use OpenAI, Anthropic, Google, Mistral or other OpenAI-compatible models.